Track a user activity

[Former Member]

Hi All,

From our production system, around 500 scheduled jobs got deleted. We dont know how and who did it. We would like to find out who did this.

I checked with the security team and found who all were having access to delete the job. Now how can i find out who all were logged in to the production system for that particular time(i.e. yesterday) and what all transaction done by those users.

Kindly help me.

Regards

Maneesh Chandran.

[Former Member]

Hi,

Your security team should be able to give you the requested information. If they can't then you should get a new team as this is basic stuff for them.

There are a few techniques, the stat records (ST03N) will give you a rough idea of who was logged in and some of the things that they did. If the audit log is activated (which it should be) then using SM20N you will be able to get the info in a better format than ST03N.

There could a whole load of reasons and methods that this happened but the above will get you started.

[Former Member]

Hi,

Also. you can try STAD.

Regards,

Vinod.

[Former Member]

What you are looking for is described in SAP Note 850885, but will most possibly be too late.

If you are fast enough, then you might be able to get the dynpro number from STAD, but again unlikely.

Cheers,

Julius

[Former Member]

Thanks you all for the help..